CVE-2026-15210

CVE-2026-15210 exposes a WordPress OTP login plugin with no rate limiting on one-time password verification—a six-digit numeric code that accepts unlimited attempts without account lockout, exponential backoff, or logging. This is not a subtle bypass or cryptographic weakness; it's a brute-force lottery that succeeds with script execution alone. A thousand installations means a thousand sites where any attacker with a simple loop can guess their way into admin accounts. The vulnerability is in the OTP Login With Phone Number plugin. If you're running any phone-based OTP login plugin on WordPress, verify it implements rate limiting on the verification endpoint, enforces account lockout after N failed attempts, and logs authentication events. The happy path works—codes generate, codes verify, users log in. The attack path works too, and it doesn't require sophistication. What makes this worth your attention beyond the CVSS score is the blast radius. Compromising a WordPress admin account doesn't just mean account takeover—it means access to the theme editor, plugin file system, wp-config.php with database credentials, and the ability to inject malicious code that reaches every visitor. This vulnerability is a delivery mechanism for supply chain compromise at scale. Check your authentication plugins now. If you can't confirm rate limiting exists, treat the plugin as a known compromised pathway. The fix isn't complex—rate limiting, attempt counters, lockout logic—but it has to be present, and it wasn't here.

Reviewed through automated stages and approved by a human before publication.